Add account signup and turnstile, subroom perms (#24)

* turnstile

* require turnstile

* homepage refresh

* implemented rooms visited endpoint for friends

* update default profile pic

* add a meta download button

* add subroom permissions

* enable signup

.env.example

@@ -64,3 +64,16 @@ RECFLARE_DOMAIN=rec.example.com
 # 0 means players start broke. Applies only to players who haven't been granted yet —
 # raising it later does NOT top up existing players.
 # RECFLARE_STARTING_TOKENS=10000
+
+# Signup on the website is configured OUTSIDE this file: it's guarded by a Cloudflare
+# Turnstile widget, and both of that widget's keys live in the shared Secrets Store
+# (RECFLARE_SECRETS_STORE above), alongside JWT_SECRET — not as vars, not as worker secrets.
+#
+#   wrangler secrets-store secret create <store-id> --name TURNSTILE_SITE_KEY \
+#     --scopes workers --remote
+#   wrangler secrets-store secret create <store-id> --name TURNSTILE_SECRET_KEY \
+#     --scopes workers --remote
+#
+# Setting them both is what opens web signup; with either missing it stays closed. See
+# DEPLOYING.md. Accounts are still created by the game either way, and both `auth` account
+# caps above apply regardless.